CN113205238A - Situation awareness defense capacity assessment method for power plant industrial control system - Google Patents

Situation awareness defense capacity assessment method for power plant industrial control system Download PDF

Info

Publication number
CN113205238A
CN113205238A CN202110254604.9A CN202110254604A CN113205238A CN 113205238 A CN113205238 A CN 113205238A CN 202110254604 A CN202110254604 A CN 202110254604A CN 113205238 A CN113205238 A CN 113205238A
Authority
CN
China
Prior art keywords
situation
information
power grid
attack
probability
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110254604.9A
Other languages
Chinese (zh)
Inventor
熊中浩
张伟
杨国玉
车业蒙
高翔
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Datang Corp Science and Technology Research Institute Co Ltd
Original Assignee
China Datang Corp Science and Technology Research Institute Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Datang Corp Science and Technology Research Institute Co Ltd filed Critical China Datang Corp Science and Technology Research Institute Co Ltd
Priority to CN202110254604.9A priority Critical patent/CN113205238A/en
Publication of CN113205238A publication Critical patent/CN113205238A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00Administration; Management
    • G06Q10/06Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063Operations research, analysis or management
    • G06Q10/0639Performance analysis of employees; Performance analysis of enterprise or organisation operations
    • G06Q10/06393Score-carding, benchmarking or key performance indicator [KPI] analysis
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00Systems or methods specially adapted for specific business sectors, e.g. utilities or tourism
    • G06Q50/06Electricity, gas or water supply
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416Event detection, e.g. attack signature detection
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433Vulnerability analysis
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/20Network architectures or network communication protocols for network security for managing network security; network security policies in general

Abstract

The invention discloses a situation awareness defense capacity assessment method for a power plant industrial control system, which comprises the following steps of: extracting situation elements, namely acquiring historical data of a power grid network situation sensing system and collecting information of a sensed object, wherein the extracted information comprises power grid fault information, operation information, equipment state information, environment information and system structure information; step two, real-time situation recognition, processing and processing the extracted situation elements, establishing a safety situation evaluation model, and evaluating the current power grid network state on the basis of the processed situation element information; and step three, predicting the future situation, namely summarizing and reasoning the situation development law of the power grid after collecting, processing and evaluating the situation information of the power grid network, and predicting the future situation of the power grid.

Description

Situation awareness defense capacity assessment method for power plant industrial control system
Technical Field
The invention relates to the technical field of data security, in particular to a situation awareness defense capability assessment method for a power plant industrial control system.
Background
The situation awareness technology is firstly used in the fields of aviation, aerospace and the like which require operators to quickly understand surrounding conditions, correctly decide and operate, and develops into a human-machine-environment complex system such as electric power and medical treatment in recent years along with the gradual maturity of theories and methods. The most direct definition of situational awareness is to know what happens around you, i.e., to perceive, understand, and predict the surrounding environment in time and space. The situation awareness technology is applied to a power system, and refers to a series of actions of acquiring, understanding, displaying and predicting future situations of elements which can cause changes of the safety situation of a power grid by a dispatcher in the power grid environment. A situation is a state and trend that includes a current state, a evolving state, a competency state, a controllable state, and an evaluation state. The power grid situation is the current power grid state and the change trend which are formed by various power grid equipment operation states, user behaviors and other factors, and the dispatching personnel comprehensively understand the power grid safety state through the dependence of different situations, and the power grid situation has the overall concept. The grid situation awareness refers to the fact that in a grid environment, safety elements capable of causing grid situation changes are acquired, understood, displayed and the future development trend is predicted. The core idea of power grid situation awareness is to face a decision-making target, and through extraction of current situation elements of a power grid, understanding and evaluation of situations, capability state, controllable state and future development situation prediction of the power grid, data and decision-making information related to a task can be automatically provided according to the current system state and based on selection of a user and judgment of operation, so that situation awareness and decision support requirements in the task process are met, the purpose is to look ahead and perceive the power grid operation situation, and the active security defense capability of the power grid is improved.
Based on the understanding of computer network situational awareness, when a power grid accesses a large number of public networks, the smart grid faces various security threats including device, network, and data aspects. In order to improve the security monitoring and intrusion prevention capability of the power information network, a series of analysis and processing needs to be performed on the acquired information, and at this time, situation assessment needs to be performed on network information in a power grid. The evaluation of the power grid situation can be understood as reasonably explaining various possible network attacks by analyzing and reasoning according to domain knowledge and historical data and by means of certain mathematical tools and models on the basis of fusion acquisition of network monitoring data in various power grids and simple processing in a large-scale and high-complexity network environment. And finally, evaluating the current situation, and using the evaluation data base situation to predict to prevent large-scale safety accidents from happening.
Disclosure of Invention
In order to achieve the purpose, the invention provides a situation awareness defense capability assessment method for a power plant industrial control system, which comprises the following steps:
extracting situation elements, collecting historical data of a power grid network situation perception system, and collecting information of a perceived object;
step two, real-time situation recognition, processing and processing the extracted situation elements, establishing a safety situation evaluation model, and evaluating the current power grid network state on the basis of the processed situation element information;
and step three, predicting the future situation, namely summarizing and reasoning the situation development law of the power grid after collecting, processing and evaluating the situation information of the power grid network, and predicting the future situation of the power grid.
Preferably, in the step one, the information extracted by the situation element extraction includes grid fault information, operation information, equipment state information, environment information and system structure information.
Preferably, the security situation assessment model assesses the state of the power grid network based on a situation assessment subsystem in the security situation awareness system, and the security situation assessment model obtains attack occurrence probability, attack success probability and attack threat data according to the attack information, the node vulnerability information and the attack threat information through information fusion, and obtains the security situation assessment of the power grid through information fusion.
Preferably, the attack occurrence probability is the probability that a security attack obtained by information collection and fusion in the security situation awareness system has occurred.
Preferably, the attack success probability is determined by the external attack and the internal environment of the host node after the security attack, and the internal environment of the host node includes the factor capable of judging the attack success rate including the vulnerability information of the host node.
Preferably, the attack threat is the maximum impact that the attack may bring, that is, the impact that the host node has when satisfying all vulnerabilities and conditions on which the attack depends.
Preferably, the security situation awareness system comprises an information acquisition subsystem, a situation assessment subsystem, a situation prediction subsystem and a situation visual subsystem, wherein the information acquisition subsystem is used for collecting electric quantity information, non-electric quantity information and power grid state data information of the power system; the situation evaluation subsystem is used for comprehensively identifying and evaluating the information collected by the information acquisition subsystem; the situation prediction subsystem is used for summarizing the power grid situation rules through the situation evaluation results and predicting the future situation of the power grid; the situation visualization subsystem is used for visually displaying data in the power grid situation perception system.
Preferably, the data visualization display in the power grid situation awareness system includes the following steps:
firstly, carrying out data cleaning and format conversion processing on situation perception element information;
step two, extracting information of the processed situation perception element information according to the relevance of the situation perception element information in the space and time dimensions;
step three, associating the extracted situation perception element information with each node in a corresponding topological model of the power grid database according to the spatial dimension;
and step four, calculating the safety situation index value of the grounding point according to the time dimension of the associated node and the element statistical information.
Preferably, the safety situation index value comprises a health state probability, an alert state probability, a fault state probability, a power flow safety probability, a power flow overload probability and a power flow overload load shedding probability.
Compared with the prior art, the invention has the beneficial effects that:
1) according to the situation awareness defense capacity assessment method for the power plant industrial control system, a safety situation assessment model is established, and the influence of attacks on a power grid can be obtained by fusing the information of attack information, node vulnerability information and attack threat information from three angles, so that the effect of the attack on the power grid can be achieved, the effect of the safety situation assessment on the power grid is achieved, and the development and change trend of external situations is predicted.
2) According to the situation awareness defense capacity assessment method for the power plant industrial control system, data in the power grid situation awareness system can be visually represented by visually displaying the data in the power grid situation awareness system, and the change characteristics of the data are displayed in different graphic states, so that a worker can conveniently make a safety strategy.
According to the method, through a situation awareness technology, refinement of power grid network security management and network security of a power grid are facilitated to be improved, and perception, understanding and decision-making behavior of scheduling personnel on the power grid security risk situation can be rapidly achieved through situation element extraction, real-time situation recognition and future situation prediction.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a schematic diagram of a security posture assessment model according to the present invention.
Detailed Description
The technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.
The invention provides the following technical scheme:
example one
A situation awareness defense capacity assessment method for a power plant industrial control system comprises the following steps:
extracting situation elements, namely acquiring historical data of a power grid network situation sensing system and collecting information of a sensed object, wherein the extracted information comprises power grid fault information, operation information, equipment state information, environment information and system structure information;
step two, real-time situation recognition, processing and processing the extracted situation elements, establishing a safety situation evaluation model, and evaluating the current power grid network state on the basis of the processed situation element information;
and step three, predicting the future situation, namely summarizing and reasoning the situation development law of the power grid after collecting, processing and evaluating the situation information of the power grid network, and predicting the future situation of the power grid.
Referring to fig. 1, a security situation assessment model assesses the state of a power grid network based on a situation assessment subsystem in a security situation sensing system, the security situation assessment model respectively obtains attack occurrence probability, attack success probability and attack threat data according to attack information, node vulnerability information and attack threat information through information fusion, and obtains security situation assessment of the power grid after the information fusion; the attack occurrence probability is the probability that the security attack has occurred, which is obtained by information collection and fusion in the security situation perception system; the attack success probability is determined by external attack and the internal environment of the host node after the safety attack, and the internal environment of the host node comprises the factors which can judge the attack success rate and comprise the vulnerability information of the host node; the attack threat is the biggest impact that the attack may bring, namely the impact that the host node causes when all the vulnerabilities and conditions on which the attack depends are met.
The security situation awareness system mainly has the following functions:
1) identifying and confirming the current situation;
2) evaluation of possible influences;
3) analyzing the intention of an attacker;
4) sensing the accuracy of decision and situation collection;
5) and (4) prediction of future situation.
The safety situation perception system specifically comprises an information acquisition subsystem, a situation evaluation subsystem, a situation prediction subsystem and a situation visual subsystem, wherein the information acquisition subsystem is used for collecting electric quantity information, non-electric quantity information and power grid state data information of the power system; the situation evaluation subsystem is used for comprehensively identifying and evaluating the information collected by the information acquisition subsystem; the situation prediction subsystem is used for summarizing the power grid situation rules through the situation evaluation results and predicting the future situation of the power grid; and the situation visualization subsystem is used for visually displaying data in the power grid situation perception system.
The data display in the power grid situation awareness system comprises the following steps:
firstly, carrying out data cleaning and format conversion processing on situation perception element information;
step two, extracting information of the processed situation perception element information according to the relevance of the situation perception element information in the space and time dimensions;
step three, associating the extracted situation perception element information with each node in a corresponding topological model of the power grid database according to the spatial dimension;
step four, calculating the safety situation index value of the grounding point according to the time dimension of the associated node and the element statistical information; the safety situation index value comprises a health state probability, an alert state probability, a fault state probability, a power flow safety probability, a power flow overload probability and a power flow overload load shedding probability.
Wherein, the situation element extraction mainly comprises the following technologies:
1) a two-sided optimal configuration technique that improves observability;
2) PMU optimal configuration and data application technology;
3) advanced two-sided architecture techniques.
The preferred embodiments of the invention disclosed above are intended to be illustrative only. The preferred embodiments are not intended to be exhaustive or to limit the invention to the precise embodiments disclosed. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and the practical application, to thereby enable others skilled in the art to best utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims (9)

1. A situation awareness defense capacity assessment method for a power plant industrial control system is characterized by comprising the following steps:
extracting situation elements, collecting historical data of a power grid network situation perception system, and collecting information of a perceived object;
step two, real-time situation recognition, processing and processing the extracted situation elements, establishing a safety situation evaluation model, and evaluating the current power grid network state on the basis of the processed situation element information;
and step three, predicting the future situation, namely summarizing and reasoning the situation development law of the power grid after collecting, processing and evaluating the situation information of the power grid network, and predicting the future situation of the power grid.
2. The method for assessing the situation awareness defense capability of the power plant industrial control system according to claim 1, wherein in the step one, the extracted information extracted by the situation element extraction includes grid fault information, operation information, equipment state information, environmental information and system structure information.
3. The situation awareness defense capability assessment method for the power plant industrial control system according to claim 1, wherein the security situation assessment model assesses the state of the power grid network based on a situation assessment subsystem in the security situation awareness system, the security situation assessment model respectively obtains attack occurrence probability, attack success probability and attack threat data according to attack information, node vulnerability information and attack threat information through information fusion, and obtains the security situation assessment of the power grid after the information fusion.
4. The method for evaluating the situation awareness defense capability of the power plant industrial control system according to claim 3, wherein the attack occurrence probability is a probability that a security attack obtained by information collection and fusion in the security situation awareness system has occurred.
5. The situation awareness defense capability assessment method for the power plant industrial control system according to claim 3, wherein the attack success probability is determined by external attack and the internal environment of the host node after the safety attack, and the internal environment of the host node includes the vulnerability information of the host node, which can be used for judging the attack success rate.
6. The method for evaluating the situation awareness defense capability of the power plant industrial control system, according to claim 3, is characterized in that the attack threat is the maximum influence which may be brought by the attack, namely the influence caused when the host node meets all vulnerabilities and conditions on which the attack depends.
7. The assessment method for situation awareness defense capacity of the power plant industrial control system according to claim 3, wherein the security situation awareness system comprises an information acquisition subsystem, a situation assessment subsystem, a situation prediction subsystem and a situation visualization subsystem, wherein the information acquisition subsystem is used for collecting electric quantity information, non-electric quantity information and power grid state data information of the power system; the situation evaluation subsystem is used for comprehensively identifying and evaluating the information collected by the information acquisition subsystem; the situation prediction subsystem is used for summarizing the power grid situation rules through the situation evaluation results and predicting the future situation of the power grid; the situation visualization subsystem is used for visually displaying data in the power grid situation perception system.
8. The method for evaluating the situation awareness defense capacity of the power plant industrial control system according to claim 7, wherein the visualized display of the data in the power grid situation awareness system comprises the following steps:
firstly, carrying out data cleaning and format conversion processing on situation perception element information;
step two, extracting information of the processed situation perception element information according to the relevance of the situation perception element information in the space and time dimensions;
step three, associating the extracted situation perception element information with each node in a corresponding topological model of the power grid database according to the spatial dimension;
and step four, calculating the safety situation index value of the grounding point according to the time dimension of the associated node and the element statistical information.
9. The method for assessing the situation awareness defense capability of the power plant industrial control system according to claim 8, wherein the safety situation index values comprise a health state probability, a warning state probability, a fault state probability, a power flow safety probability, a power flow overload probability and a power flow overload load shedding probability.
CN202110254604.9A 2021-03-09 2021-03-09 Situation awareness defense capacity assessment method for power plant industrial control system Pending CN113205238A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110254604.9A CN113205238A (en) 2021-03-09 2021-03-09 Situation awareness defense capacity assessment method for power plant industrial control system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110254604.9A CN113205238A (en) 2021-03-09 2021-03-09 Situation awareness defense capacity assessment method for power plant industrial control system

Publications (1)

Publication Number Publication Date
CN113205238A true CN113205238A (en) 2021-08-03

Family

ID=77025419

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110254604.9A Pending CN113205238A (en) 2021-03-09 2021-03-09 Situation awareness defense capacity assessment method for power plant industrial control system

Country Status (1)

Country Link
CN (1) CN113205238A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114528554A (en) * 2022-01-25 2022-05-24 国网湖北省电力有限公司孝感供电公司 Information security operation scene monitoring display platform
CN114629677A (en) * 2021-11-26 2022-06-14 中国大唐集团科学技术研究院有限公司火力发电技术研究院 Safety protection system and method for thermal power generating unit electric quantity charging system
CN116633685A (en) * 2023-07-19 2023-08-22 国家计算机网络与信息安全管理中心江西分中心 Analysis method based on IPv6 development situation monitoring

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100057649A1 (en) * 2008-09-04 2010-03-04 Chang Eun Lee System and method for fault prediction in home network
CN108494810A (en) * 2018-06-11 2018-09-04 中国人民解放军战略支援部队信息工程大学 Network security situation prediction method, apparatus and system towards attack

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100057649A1 (en) * 2008-09-04 2010-03-04 Chang Eun Lee System and method for fault prediction in home network
CN108494810A (en) * 2018-06-11 2018-09-04 中国人民解放军战略支援部队信息工程大学 Network security situation prediction method, apparatus and system towards attack

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
李晓晶等: "智能电网态势感知及评估方法", 中国科技信息, no. 21, pages 105 - 106 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114629677A (en) * 2021-11-26 2022-06-14 中国大唐集团科学技术研究院有限公司火力发电技术研究院 Safety protection system and method for thermal power generating unit electric quantity charging system
CN114629677B (en) * 2021-11-26 2024-03-19 中国大唐集团科学技术研究院有限公司火力发电技术研究院 Safety protection system and method for electric quantity charging system of thermal power generating unit
CN114528554A (en) * 2022-01-25 2022-05-24 国网湖北省电力有限公司孝感供电公司 Information security operation scene monitoring display platform
CN114528554B (en) * 2022-01-25 2023-03-10 国网湖北省电力有限公司孝感供电公司 Information security operation scene monitoring display platform
CN116633685A (en) * 2023-07-19 2023-08-22 国家计算机网络与信息安全管理中心江西分中心 Analysis method based on IPv6 development situation monitoring

Similar Documents

Publication Publication Date Title
CN113205238A (en) Situation awareness defense capacity assessment method for power plant industrial control system
CN110149327B (en) Network security threat warning method and device, computer equipment and storage medium
US20150304346A1 (en) Apparatus and method for detecting anomaly of network
JP2018170006A (en) Generic framework to detect cyber threats in electric power grid
CN106888205A (en) A kind of non-intrusion type is based on the PLC method for detecting abnormality of power consumption analysis
CN105357063B (en) A kind of cyberspace security postures real-time detection method
CN101883017B (en) System and method for evaluating network safe state
CN109767352B (en) Safety situation assessment method for electric power information physical fusion system
CN105868629B (en) Security threat situation assessment method suitable for electric power information physical system
CN102324066A (en) Radar chart representation method for early warning and assessment index of power system
CN116366374B (en) Security assessment method, system and medium for power grid network management based on big data
CN114358106A (en) System anomaly detection method and device, computer program product and electronic equipment
CN102891761B (en) Equipment performance prediction processing method and device
KR101281456B1 (en) Apparatus and method for anomaly detection in SCADA network using self-similarity
CN112488877A (en) Industrial energy consumption visualization system for energy service platform
CN116720324A (en) Traction substation key equipment fault early warning method and system based on prediction model
CN114666117A (en) Network security situation measuring and predicting method for power internet
CN112596984B (en) Data security situation awareness system in business weak isolation environment
CN112070400A (en) Method and device for evaluating security situation of power grid database
CN108761250B (en) Industrial control equipment voltage and current-based intrusion detection method
CN111090014A (en) Electrical appliance identification method and device based on Gaussian model
CN116015903A (en) Network security situation awareness comprehensive analysis system and method thereof
Chang et al. Safety risk assessment of electric power operation site based on variable precision rough set
CN115550034A (en) Service flow monitoring method and device for distribution network power monitoring system
CN114241400A (en) Monitoring method and device of power grid system and computer readable storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination